[Puppet Users] puppet push mode
Hello All, I am trying to put puppet into push mode only. The instructions I've seen have said to put listen=true in puppet.conf but that doesn't seem to have stopped the pull every 30 minutes. What else needs to be set? Thanks, Jim -- “Twenty years from now you will be more disappointed by the things that you didn’t do than by the ones you did do. So throw off the bowlines. Sail away from the safe harbor. Catch the trade winds in your sails. Explore. Dream. Discover.” – Mark Twain -- You received this message because you are subscribed to the Google Groups "Puppet Users" group. To post to this group, send email to puppet-us...@googlegroups.com. To unsubscribe from this group, send email to puppet-users+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en.
Re: [Puppet Users] puppet push mode
I couldn't find anything that said the setting of runinterval would affect the stopping of pull. Ohad, I did find the no-client option and have it in effect. It does appear to stop the pull. On Wed, Oct 6, 2010 at 7:53 AM, Ohad Levy wrote: > --no-client > > Ohad > > On Tue, Oct 5, 2010 at 3:33 PM, James Louis wrote: > >> Hello All, >> >> I am trying to put puppet into push mode only. The instructions I've seen >> have said to put listen=true in puppet.conf but that doesn't seem to have >> stopped the pull every 30 minutes. What else needs to be set? >> >> Thanks, >> >> Jim >> >> -- >> “Twenty years from now you will be more disappointed by the things that >> you didn’t do than by the ones you did do. So throw off the bowlines. Sail >> away from the safe harbor. Catch the trade winds in your sails. Explore. >> Dream. Discover.” >> – Mark Twain >> >> -- >> You received this message because you are subscribed to the Google Groups >> "Puppet Users" group. >> To post to this group, send email to puppet-us...@googlegroups.com. >> To unsubscribe from this group, send email to >> puppet-users+unsubscr...@googlegroups.com >> . >> For more options, visit this group at >> http://groups.google.com/group/puppet-users?hl=en. >> > > -- > You received this message because you are subscribed to the Google Groups > "Puppet Users" group. > To post to this group, send email to puppet-us...@googlegroups.com. > To unsubscribe from this group, send email to > puppet-users+unsubscr...@googlegroups.com > . > For more options, visit this group at > http://groups.google.com/group/puppet-users?hl=en. > -- “Twenty years from now you will be more disappointed by the things that you didn’t do than by the ones you did do. So throw off the bowlines. Sail away from the safe harbor. Catch the trade winds in your sails. Explore. Dream. Discover.” – Mark Twain -- You received this message because you are subscribed to the Google Groups "Puppet Users" group. To post to this group, send email to puppet-us...@googlegroups.com. To unsubscribe from this group, send email to puppet-users+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en.
Re: [Puppet Users] puppet push mode
Pete, Is there a central location for Puppet documentation? I would be glad to add/update the docs. Seems there should be a chapter/paragraph on using push only. Jim On Wed, Oct 6, 2010 at 8:16 AM, Peter Meier wrote: > On 10/06/2010 03:01 PM, James Louis wrote: > > I couldn't find anything that said the setting of runinterval would > affect > > the stopping of pull. Ohad, I did find the no-client option and have it > in > > effect. It does appear to stop the pull. > > can you look a ticket to improve documentation? Or even contribute a > patch? Thanks! > > ~pete > > -- > You received this message because you are subscribed to the Google Groups > "Puppet Users" group. > To post to this group, send email to puppet-us...@googlegroups.com. > To unsubscribe from this group, send email to > puppet-users+unsubscr...@googlegroups.com > . > For more options, visit this group at > http://groups.google.com/group/puppet-users?hl=en. > > -- “Twenty years from now you will be more disappointed by the things that you didn’t do than by the ones you did do. So throw off the bowlines. Sail away from the safe harbor. Catch the trade winds in your sails. Explore. Dream. Discover.” – Mark Twain -- You received this message because you are subscribed to the Google Groups "Puppet Users" group. To post to this group, send email to puppet-us...@googlegroups.com. To unsubscribe from this group, send email to puppet-users+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en.
Re: [Puppet Users] puppet push mode
you have to use --no-client on the command line when running puppetd. I've set it up in my /etc/sysconfig/puppet file on CentOS so it's pulled in as part of PUPPET_EXTRAOPTS. On Wed, Oct 6, 2010 at 3:09 PM, Mohamed Lrhazi wrote: > On Wed, Oct 6, 2010 at 9:01 AM, James Louis wrote: > > I couldn't find anything that said the setting of runinterval would > affect > > the stopping of pull. Ohad, I did find the no-client option and have it > in > > effect. It does appear to stop the pull. > > > > That does not work for me... what version are you using? > > I set client=false in the client's puppet.conf > [puppetd] >report = true >listen = true >#noop = true >client = false >#ignorecache = true > > But when I start puppet: /etc/init.d/puppet start > It still downloads the config, and applies it... > > How do I make it download and apply only when triggered by puppetrun? > > And better yet... how do I make it work in noop mode, always, and in > op mode only on request? > > Thanks so much. > Mohamed. > > -- > You received this message because you are subscribed to the Google Groups > "Puppet Users" group. > To post to this group, send email to puppet-us...@googlegroups.com. > To unsubscribe from this group, send email to > puppet-users+unsubscr...@googlegroups.com > . > For more options, visit this group at > http://groups.google.com/group/puppet-users?hl=en. > > -- “Twenty years from now you will be more disappointed by the things that you didn’t do than by the ones you did do. So throw off the bowlines. Sail away from the safe harbor. Catch the trade winds in your sails. Explore. Dream. Discover.” – Mark Twain -- You received this message because you are subscribed to the Google Groups "Puppet Users" group. To post to this group, send email to puppet-us...@googlegroups.com. To unsubscribe from this group, send email to puppet-users+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en.
Re: [Puppet Users] puppet push mode
that sounds like how I would set it up On Wed, Oct 6, 2010 at 4:42 PM, Mohamed Lrhazi wrote: > I think I got it... > > - Run puppetd with --no-client and listen mode. Activate changes by > calling puppetrun > - From cron, run puppetd --noop on regular basis to report on the config. > > Would this be proper configuration or would it be an unsupported hack ? > > Thanks a lot. > Mohamed. > > -- > You received this message because you are subscribed to the Google Groups > "Puppet Users" group. > To post to this group, send email to puppet-us...@googlegroups.com. > To unsubscribe from this group, send email to > puppet-users+unsubscr...@googlegroups.com > . > For more options, visit this group at > http://groups.google.com/group/puppet-users?hl=en. > > -- “Twenty years from now you will be more disappointed by the things that you didn’t do than by the ones you did do. So throw off the bowlines. Sail away from the safe harbor. Catch the trade winds in your sails. Explore. Dream. Discover.” – Mark Twain -- You received this message because you are subscribed to the Google Groups "Puppet Users" group. To post to this group, send email to puppet-us...@googlegroups.com. To unsubscribe from this group, send email to puppet-users+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en.
Re: [Puppet Users] puppet push mode
sounds like you have puppetd already running On Wed, Oct 6, 2010 at 5:42 PM, Mohamed Lrhazi wrote: > The error when run without --test is: > > # puppetd --noop --onetime > Could not prepare for execution: Could not create PID file: > /var/lib/puppet/run/puppetd.pid > > > > On Wed, Oct 6, 2010 at 6:40 PM, Mohamed Lrhazi wrote: > > On Wed, Oct 6, 2010 at 6:33 PM, James Louis wrote: > >> that sounds like how I would set it up > >> > > > > One little problem though It I try to run puppetd from command > > line (and I assume from cron) with --onetime and --noop, while the > > listner is running, I get this: > > > > # puppetd --noop --test > > notice: Ignoring --listen on onetime run > > info: Caching catalog for chapeau.uis.georgetown.edu > > info: Applying configuration version '1286391176' > > notice: Finished catalog run in 8.16 seconds > > > > If I run the same with --test, it works fine... > > > > I could just use --test as a work around, and ignore stdout.. but what > > would be the right way? > > > > Thanks, > > > > > > -- > " Logic merely sanctions the conquests of the intuition." > Jacques Hadamard > > -- > You received this message because you are subscribed to the Google Groups > "Puppet Users" group. > To post to this group, send email to puppet-us...@googlegroups.com. > To unsubscribe from this group, send email to > puppet-users+unsubscr...@googlegroups.com > . > For more options, visit this group at > http://groups.google.com/group/puppet-users?hl=en. > > -- “Twenty years from now you will be more disappointed by the things that you didn’t do than by the ones you did do. So throw off the bowlines. Sail away from the safe harbor. Catch the trade winds in your sails. Explore. Dream. Discover.” – Mark Twain -- You received this message because you are subscribed to the Google Groups "Puppet Users" group. To post to this group, send email to puppet-us...@googlegroups.com. To unsubscribe from this group, send email to puppet-users+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en.
Re: [Puppet Users] puppet push mode
if an instance of puppetd is already running then you'll get that error message when you try to start up another instance. also there may be a puppetd.pid left from the last time it was ran. you would then have to remove that pid file. On Wed, Oct 6, 2010 at 6:16 PM, Mohamed Lrhazi wrote: > On Wed, Oct 6, 2010 at 7:07 PM, James Louis wrote: > > sounds like you have puppetd already running > > That's right. I am trying to see if I can run puppetd in listen mode, > permanently. AND, from shell/cron, run puppetd --noop. > > Goal: > - Receive constant reports about what needs to run (from the noop puppetd) > - Be able to run a one time "do it now" through the listen-only puppetd. > > Thanks, > Mohamed. > > -- > You received this message because you are subscribed to the Google Groups > "Puppet Users" group. > To post to this group, send email to puppet-us...@googlegroups.com. > To unsubscribe from this group, send email to > puppet-users+unsubscr...@googlegroups.com > . > For more options, visit this group at > http://groups.google.com/group/puppet-users?hl=en. > > -- “Twenty years from now you will be more disappointed by the things that you didn’t do than by the ones you did do. So throw off the bowlines. Sail away from the safe harbor. Catch the trade winds in your sails. Explore. Dream. Discover.” – Mark Twain -- You received this message because you are subscribed to the Google Groups "Puppet Users" group. To post to this group, send email to puppet-us...@googlegroups.com. To unsubscribe from this group, send email to puppet-users+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en.
Re: [Puppet Users] puppet push mode
all I know is you should probably only run one instance at a time. I'm kinda of a noob at this too so I hope I've been helpful. On Wed, Oct 6, 2010 at 7:20 PM, Mohamed Lrhazi wrote: > On Wed, Oct 6, 2010 at 7:33 PM, James Louis wrote: > > if an instance of puppetd is already running then you'll get that error > > message when you try to start up another instance. also there may be a > > puppetd.pid left from the last time it was ran. you would then have to > > remove that pid file. > > > > Thanks James. I understand. > My question is that with --test option, the second puppetd seems to > work fine... Is it? > Should I just use --test option to run this second puppetd, or is > there a better way? > > Thanks. > Mohamed. > > > On Wed, Oct 6, 2010 at 6:16 PM, Mohamed Lrhazi wrote: > >> > >> On Wed, Oct 6, 2010 at 7:07 PM, James Louis > wrote: > >> > sounds like you have puppetd already running > >> > >> That's right. I am trying to see if I can run puppetd in listen mode, > >> permanently. AND, from shell/cron, run puppetd --noop. > >> > >> Goal: > >> - Receive constant reports about what needs to run (from the noop > puppetd) > >> - Be able to run a one time "do it now" through the listen-only puppetd. > >> > >> Thanks, > >> Mohamed. > >> > >> -- > >> You received this message because you are subscribed to the Google > Groups > >> "Puppet Users" group. > >> To post to this group, send email to puppet-us...@googlegroups.com. > >> To unsubscribe from this group, send email to > >> puppet-users+unsubscr...@googlegroups.com > . > >> For more options, visit this group at > >> http://groups.google.com/group/puppet-users?hl=en. > >> > > > > > > > > -- > > “Twenty years from now you will be more disappointed by the things that > you > > didn’t do than by the ones you did do. So throw off the bowlines. Sail > away > > from the safe harbor. Catch the trade winds in your sails. Explore. > Dream. > > Discover.” > > – Mark Twain > > > > -- > > You received this message because you are subscribed to the Google Groups > > "Puppet Users" group. > > To post to this group, send email to puppet-us...@googlegroups.com. > > To unsubscribe from this group, send email to > > puppet-users+unsubscr...@googlegroups.com > . > > For more options, visit this group at > > http://groups.google.com/group/puppet-users?hl=en. > > > > > > -- > " Logic merely sanctions the conquests of the intuition." > Jacques Hadamard > > -- > You received this message because you are subscribed to the Google Groups > "Puppet Users" group. > To post to this group, send email to puppet-us...@googlegroups.com. > To unsubscribe from this group, send email to > puppet-users+unsubscr...@googlegroups.com > . > For more options, visit this group at > http://groups.google.com/group/puppet-users?hl=en. > > -- “Twenty years from now you will be more disappointed by the things that you didn’t do than by the ones you did do. So throw off the bowlines. Sail away from the safe harbor. Catch the trade winds in your sails. Explore. Dream. Discover.” – Mark Twain -- You received this message because you are subscribed to the Google Groups "Puppet Users" group. To post to this group, send email to puppet-us...@googlegroups.com. To unsubscribe from this group, send email to puppet-users+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en.
Re: [Puppet Users] preferred directory structure for multiple environments
Thanks Daniel,
in puppet.conf on the server: (we are just trying to get a file installed to
the int environment client)
[main]
vardir = /var/lib/puppet
logdir = /var/log/puppet
rundir = /var/run/puppet
ssldir = $vardir/ssl
pidfile=$rundir/puppetmaster.pid
[int]
#modulepath = /etc/puppet/modules/int
#manifest = /etc/puppet/manifests/int/site.pp
manifest = /etc/puppet/int/site.pp
modulepath = /etc/puppet/int/modules
[pfm]
modulepath = /etc/puppet/modules/pfm
manifest = /etc/puppet/manifests/pfm/site.pp
[site2]
modulepath = /etc/puppet/modules/site2
manifest = /etc/puppet/manifests/site2/site.pp
[agent]
classfile = $vardir/classes.txt
localconfig = $vardir/localconfig
# libdir =
/usr/local/puppet-dashboard/lib:/usr/local/puppet-dashboard/lib/puppet
[master]
reports = http, store
environments = pfm,int,site2
#environment = pfm
---
the client puppet.conf:
[main]
vardir = /var/lib/puppet
logdir = /var/log/puppet
rundir = /var/run/puppet
ssldir = $vardir/ssl
[agent]
classfile = $vardir/classes.txt
localconfig = $vardir/localconfig
runinterval = 300
environment=int
report = true
# /etc/puppet/int/site.pp
import "modules"
import "nodes"
node default {
include barfoo
}
#/etc/puppet/int/modules/barfoo/manifests/init.pp
class barfoo {
file { "/tmp/myFile":
owner => root,
group => root,
mode=> 666,
source => "puppet:///modules/barfoo/myFile"
}
}
/etc/puppet/int/modules/barfoo/files/myFile exists but it doesn't get put on
the agent in the int environment. There must be something we are not seeing
here.
On Thu, Nov 11, 2010 at 4:27 PM, Daniel Pittman wrote:
> techn0gichida writes:
>
> > Moving from 2.5 to 2.6.2 and I was wondering if there is a preferred
> > directory structure for using multiple environments? Does it work much
> > different in 2.6 than in 2.5?
>
> Not really substantially, no.
>
> > When I made the move I assumed (I know) that my current structure and
> > configurations would just roll over but that isn't the case.
>
> It would be super-great if you could let us know what the problems were.
> (Perhaps you have in other messages, but better to ask twice than never
> hear
> what problems folks are hitting, I figure. :)
>
> Regards,
>Daniel
> --
> ✣ Daniel Pittman✉ dan...@rimspace.net☎ +61 401 155
> 707
> ♽ made with 100 percent post-consumer electrons
>
> --
> You received this message because you are subscribed to the Google Groups
> "Puppet Users" group.
> To post to this group, send email to puppet-us...@googlegroups.com.
> To unsubscribe from this group, send email to
> puppet-users+unsubscr...@googlegroups.com
> .
> For more options, visit this group at
> http://groups.google.com/group/puppet-users?hl=en.
>
>
--
“Twenty years from now you will be more disappointed by the things that you
didn’t do than by the ones you did do. So throw off the bowlines. Sail away
from the safe harbor. Catch the trade winds in your sails. Explore. Dream.
Discover.”
– Mark Twain
--
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To post to this group, send email to puppet-us...@googlegroups.com.
To unsubscribe from this group, send email to
puppet-users+unsubscr...@googlegroups.com.
For more options, visit this group at
http://groups.google.com/group/puppet-users?hl=en.
Re: [Puppet Users] Re: preferred directory structure for multiple environments
Don't know what to tell you. Commenting out the line in that file fixed the problem. And it's been working great since. On Thu, Nov 18, 2010 at 5:51 PM, Felix Frank < felix.fr...@alumni.tu-berlin.de> wrote: > On 12.11.2010 19:22, techn0gichida wrote: > >> I found the problem in /etc/sysconfig/puppetmaster. The MANIFEST >> directive wasn't commented out. Shouldn't this be commented on that it >> needs to be commented out for multiple environment use? >> > > I don't really see your point. Yes, there is a commented out line in the > posted config. Randomly commenting out such a line from your conf surely > won't fix a problem you're having? > > Besides, theres a perfectly functional manifest= line just below it: > > > [int] >>> #modulepath = /etc/puppet/modules/int >>> #manifest = /etc/puppet/manifests/int/site.pp >>> manifest = /etc/puppet/int/site.pp >>> modulepath = /etc/puppet/int/modules >>> >> > Regards, > Felix > > > -- > You received this message because you are subscribed to the Google Groups > "Puppet Users" group. > To post to this group, send email to puppet-us...@googlegroups.com. > To unsubscribe from this group, send email to > puppet-users+unsubscr...@googlegroups.com > . > For more options, visit this group at > http://groups.google.com/group/puppet-users?hl=en. > > -- “Twenty years from now you will be more disappointed by the things that you didn’t do than by the ones you did do. So throw off the bowlines. Sail away from the safe harbor. Catch the trade winds in your sails. Explore. Dream. Discover.” – Mark Twain -- You received this message because you are subscribed to the Google Groups "Puppet Users" group. To post to this group, send email to puppet-us...@googlegroups.com. To unsubscribe from this group, send email to puppet-users+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en.
Re: [Puppet Users] Re: preferred directory structure for multiple environments
That's good to know. I originally installed on OpenSuse and it set up the sysconfig file automagically. Now I'm working on CentOS and what I'm hearing is I don't need to set up a sysconfig file (which I already have). On Fri, Nov 19, 2010 at 8:47 AM, jcbollinger wrote: > > On Nov 18, 6:32 pm, James Louis wrote: > > Don't know what to tell you. Commenting out the line in that file fixed > the > > problem. And it's been working great since. > > I'm glad your problem is fixed. > > Folks around here have previously informed me that the whole /etc/ > sysconfig interface dates from a time before Puppet had its own > configuration files. There is nothing you can configure that way that > you cannot also configure via the main config file, but the reverse is > not true, so you might consider consolidating your Puppet > configuration into /etc/puppet/puppet.conf. > > > Cheers, > > John > > -- > You received this message because you are subscribed to the Google Groups > "Puppet Users" group. > To post to this group, send email to puppet-us...@googlegroups.com. > To unsubscribe from this group, send email to > puppet-users+unsubscr...@googlegroups.com > . > For more options, visit this group at > http://groups.google.com/group/puppet-users?hl=en. > > -- “Twenty years from now you will be more disappointed by the things that you didn’t do than by the ones you did do. So throw off the bowlines. Sail away from the safe harbor. Catch the trade winds in your sails. Explore. Dream. Discover.” – Mark Twain -- You received this message because you are subscribed to the Google Groups "Puppet Users" group. To post to this group, send email to puppet-us...@googlegroups.com. To unsubscribe from this group, send email to puppet-users+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en.
Re: [Puppet Users] Re: error running puppetrun
I'm kind of new at all this too but has something been changed recently on the server(s) or the network? It looks like there might be a problem with accessing network information. On Tue, Dec 7, 2010 at 5:35 AM, Himanshu Raina wrote: > Hi, > > Is there anyone who can help in this regard ?? > > On Mon, Dec 6, 2010 at 7:00 PM, Himanshu Raina > wrote: > > Hi, > > > > Any help in this regard would be appreciated. Also, when I run the > puppetmasterd > > with --verbose --no-daemonize --debug mode I get the following output > > > > debug: Creating default schedules > > debug: > /Settings[/etc/puppet/puppet.conf]/Settings[puppetmasterd]/File[/etc/puppet/manifests/site.pp]: > > Autorequiring File[/etc/puppet/manifests > > ] > > debug: Finishing transaction -607314048 with 0 changes > > info: Listening on port 8140 > > notice: Starting Puppet server version 0.24.8 > > debug: Overriding :::192.168.2.2 with cert name 192.168.2.2 > > debug: Allowing authenticated client 192.168.2.2(:::192.168.2.2) > > access to puppetmaster.getconfig > > debug: Our client is remote > > info: Expiring the node cache of 192.168.2.2 > > warning: Could not retrieve fact ipaddress > > warning: Could not retrieve fact fqdn > > err: Could not call: Could not find terminus plain for indirection node > > > > regards, > > > > On Mon, Dec 6, 2010 at 4:43 PM, dopedoxygen > wrote: > >> Hi, > >> > >> I have been getting the below error for sometime now. Both master and > >> client are using version 0.24.8. > >> > >> Output from /var/log/messages > >> > >> err: Could not call puppetmaster.getconfig: #<#: > >> execution expired> > >> err: Could not retrieve catalog: execution expired > >> > >> > >> P.S- all of this was working absolutely fine and suddenly has started > >> to misbehave. > >> > >> Regards, > >> > > > > -- > You received this message because you are subscribed to the Google Groups > "Puppet Users" group. > To post to this group, send email to puppet-us...@googlegroups.com. > To unsubscribe from this group, send email to > puppet-users+unsubscr...@googlegroups.com > . > For more options, visit this group at > http://groups.google.com/group/puppet-users?hl=en. > > -- “Twenty years from now you will be more disappointed by the things that you didn’t do than by the ones you did do. So throw off the bowlines. Sail away from the safe harbor. Catch the trade winds in your sails. Explore. Dream. Discover.” – Mark Twain -- You received this message because you are subscribed to the Google Groups "Puppet Users" group. To post to this group, send email to puppet-us...@googlegroups.com. To unsubscribe from this group, send email to puppet-users+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en.
Re: [Puppet Users] Re: error running puppetrun
Have you tried to run with --debug? On Tue, Dec 7, 2010 at 11:59 PM, Himanshu Raina wrote: > Hi, > > The cpu is hardly busy. I'm not clear on the network part though cause > DNS resolutions and n/w connectivity everything's fine. It's just that > out of the blue had this problem. > > regards, > > On Wed, Dec 8, 2010 at 6:58 AM, Iain Sutton wrote: > > We experience this problem too. Our puppetmaster is overloaded (was fine > > until we enabled storeconfigs against a mysql server on the same host, > now > > it's CPU bound, but we're okay with this for the short term). > > > > Do you have something chewing CPU on your systems? > > > > On 8 December 2010 00:07, James Louis wrote: > >> > >> I'm kind of new at all this too but has something been changed recently > on > >> the server(s) or the network? It looks like there might be a problem > with > >> accessing network information. > >> > >> On Tue, Dec 7, 2010 at 5:35 AM, Himanshu Raina > >> wrote: > >>> > >>> Hi, > >>> > >>> Is there anyone who can help in this regard ?? > >>> > >>> On Mon, Dec 6, 2010 at 7:00 PM, Himanshu Raina > >>> wrote: > >>> > Hi, > >>> > > >>> > Any help in this regard would be appreciated. Also, when I run the > >>> > puppetmasterd > >>> > with --verbose --no-daemonize --debug mode I get the following output > >>> > > >>> > debug: Creating default schedules > >>> > debug: > >>> > > /Settings[/etc/puppet/puppet.conf]/Settings[puppetmasterd]/File[/etc/puppet/manifests/site.pp]: > >>> > Autorequiring File[/etc/puppet/manifests > >>> > ] > >>> > debug: Finishing transaction -607314048 with 0 changes > >>> > info: Listening on port 8140 > >>> > notice: Starting Puppet server version 0.24.8 > >>> > debug: Overriding :::192.168.2.2 with cert name 192.168.2.2 > >>> > debug: Allowing authenticated client 192.168.2.2(:::192.168.2.2) > >>> > access to puppetmaster.getconfig > >>> > debug: Our client is remote > >>> > info: Expiring the node cache of 192.168.2.2 > >>> > warning: Could not retrieve fact ipaddress > >>> > warning: Could not retrieve fact fqdn > >>> > err: Could not call: Could not find terminus plain for indirection > node > >>> > > >>> > regards, > >>> > > >>> > On Mon, Dec 6, 2010 at 4:43 PM, dopedoxygen > >>> > wrote: > >>> >> Hi, > >>> >> > >>> >> I have been getting the below error for sometime now. Both master > and > >>> >> client are using version 0.24.8. > >>> >> > >>> >> Output from /var/log/messages > >>> >> > >>> >> err: Could not call puppetmaster.getconfig: #<#: > >>> >> execution expired> > >>> >> err: Could not retrieve catalog: execution expired > >>> >> > >>> >> > >>> >> P.S- all of this was working absolutely fine and suddenly has > started > >>> >> to misbehave. > >>> >> > >>> >> Regards, > >>> >> > >>> > > >>> > >>> -- > >>> You received this message because you are subscribed to the Google > Groups > >>> "Puppet Users" group. > >>> To post to this group, send email to puppet-us...@googlegroups.com. > >>> To unsubscribe from this group, send email to > >>> puppet-users+unsubscr...@googlegroups.com > . > >>> For more options, visit this group at > >>> http://groups.google.com/group/puppet-users?hl=en. > >>> > >> > >> > >> > >> -- > >> “Twenty years from now you will be more disappointed by the things that > >> you didn’t do than by the ones you did do. So throw off the bowlines. > Sail > >> away from the safe harbor. Catch the trade winds in your sails. Explore. > >> Dream. Discover.” > >> – Mark Twain > >> > >> -- > >> You received this message because you are subscribed to the Google > Groups > >> "Puppet Users" group. > >> To post to this group, send email to puppet-us...@googlegroups.com. > >> To unsubscribe from this group, send
Re: [Puppet Users] Do we need a new name for "--test"?
and what is the current functionality for the --test option? On Sun, Jan 23, 2011 at 5:48 PM, Nigel Kersten wrote: > On Sun, Jan 23, 2011 at 3:38 PM, Dan Bode wrote: > > On Sun, Jan 23, 2011 at 3:35 PM, Daniel Pittman > > wrote: > >> > >> My inclination is to say that "ontime" or "verbose" have stolen the name > >> for another concept; perhaps "interactive" covers the standard use-case > well > >> enough? > >> > >> Daniel > >> > >> On Jan 23, 2011 2:45 PM, "Patrick" wrote: > >> > > >> > On Jan 23, 2011, at 1:50 PM, Adam Nielsen wrote: > >> > > >> >>> https://projects.puppetlabs.com/issues/2476 > >> >>> > >> >>> This does seem to confuse a fair few new users. > >> >>> > >> >>> What would be a better name for "--test"? > > > > maybe we could keep --test and add --noop to the list of options in sets. > > That would take away the current functionality, which is immensely useful. > > You'd be required to spell out all the --onetime --no-daemonize stuff by > hand. > > Maybe we should just make up a word. :) > > I know some people expect --noop to be implied by --test, and I have > some sympathy for that position, but before we can get there, we need > to have a name for the existing functionality that I don't want to do > away with. > > > > > > > > >> > >> >> > >> >> Using Gentoo's emerge as an example, how about --oneshot? > >> > > >> > To me, this sounds too similar to --onetime but I don't have a good > >> > suggestion. > >> > > >> > -- > >> > You received this message because you are subscribed to the Google > >> > Groups "Puppet Users" group. > >> > To post to this group, send email to puppet-users@googlegroups.com. > >> > To unsubscribe from this group, send email to > >> > puppet-users+unsubscr...@googlegroups.com > . > >> > For more options, visit this group at > >> > http://groups.google.com/group/puppet-users?hl=en. > >> > > >> > >> -- > >> You received this message because you are subscribed to the Google > Groups > >> "Puppet Users" group. > >> To post to this group, send email to puppet-users@googlegroups.com. > >> To unsubscribe from this group, send email to > >> puppet-users+unsubscr...@googlegroups.com > . > >> For more options, visit this group at > >> http://groups.google.com/group/puppet-users?hl=en. > > > > -- > > You received this message because you are subscribed to the Google Groups > > "Puppet Users" group. > > To post to this group, send email to puppet-users@googlegroups.com. > > To unsubscribe from this group, send email to > > puppet-users+unsubscr...@googlegroups.com > . > > For more options, visit this group at > > http://groups.google.com/group/puppet-users?hl=en. > > > > -- > You received this message because you are subscribed to the Google Groups > "Puppet Users" group. > To post to this group, send email to puppet-users@googlegroups.com. > To unsubscribe from this group, send email to > puppet-users+unsubscr...@googlegroups.com > . > For more options, visit this group at > http://groups.google.com/group/puppet-users?hl=en. > > -- “Twenty years from now you will be more disappointed by the things that you didn’t do than by the ones you did do. So throw off the bowlines. Sail away from the safe harbor. Catch the trade winds in your sails. Explore. Dream. Discover.” – Mark Twain -- You received this message because you are subscribed to the Google Groups "Puppet Users" group. To post to this group, send email to puppet-users@googlegroups.com. To unsubscribe from this group, send email to puppet-users+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en.
Re: [Puppet Users] Do we need a new name for "--test"?
that tells what options are applied when --test is used but doesn't explain the functionality of --test (i.e. --test is an option to enable the puppet agent to test it's connection to the puppet master by turning on the following options... blah blah blah) On Sun, Jan 23, 2011 at 6:42 PM, Patrick wrote: > > On Jan 23, 2011, at 4:02 PM, James Louis wrote: > > > and what is the current functionality for the --test option? > > To quote Nigel: > > --onetime > --no-daemonize > --ignorecache > --verbose > --no-usecacheonfailure > > and I think I'm missing some newer additions too. > > -- > You received this message because you are subscribed to the Google Groups > "Puppet Users" group. > To post to this group, send email to puppet-users@googlegroups.com. > To unsubscribe from this group, send email to > puppet-users+unsubscr...@googlegroups.com > . > For more options, visit this group at > http://groups.google.com/group/puppet-users?hl=en. > > -- “Twenty years from now you will be more disappointed by the things that you didn’t do than by the ones you did do. So throw off the bowlines. Sail away from the safe harbor. Catch the trade winds in your sails. Explore. Dream. Discover.” – Mark Twain -- You received this message because you are subscribed to the Google Groups "Puppet Users" group. To post to this group, send email to puppet-users@googlegroups.com. To unsubscribe from this group, send email to puppet-users+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en.
Re: [Puppet Users] Do we need a new name for "--test"?
exactly. to what purpose? On Sun, Jan 23, 2011 at 6:50 PM, Patrick wrote: > > On Jan 23, 2011, at 4:47 PM, James Louis wrote: > > > that tells what options are applied when --test is used but doesn't > explain the functionality of --test (i.e. --test is an option to enable the > puppet agent to test it's connection to the puppet master by turning on the > following options... blah blah blah) > > Ah. Basically, test doesn't do anything except turn on all those options. > > -- > You received this message because you are subscribed to the Google Groups > "Puppet Users" group. > To post to this group, send email to puppet-users@googlegroups.com. > To unsubscribe from this group, send email to > puppet-users+unsubscr...@googlegroups.com > . > For more options, visit this group at > http://groups.google.com/group/puppet-users?hl=en. > > -- “Twenty years from now you will be more disappointed by the things that you didn’t do than by the ones you did do. So throw off the bowlines. Sail away from the safe harbor. Catch the trade winds in your sails. Explore. Dream. Discover.” – Mark Twain -- You received this message because you are subscribed to the Google Groups "Puppet Users" group. To post to this group, send email to puppet-users@googlegroups.com. To unsubscribe from this group, send email to puppet-users+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en.
Re: [Puppet Users] Do we need a new name for "--test"?
so the actual changes take place, if any, during a test vs a noop which does not let the actual changes take place. So this would be used primarily for configuration testing? Or perhaps for troubleshooting? Or both? On Sun, Jan 23, 2011 at 7:22 PM, Nigel Kersten wrote: > On Sun, Jan 23, 2011 at 4:53 PM, James Louis wrote: > > exactly. to what purpose? > > To trigger an immediate run on a client with the common options used > when testing a real run, not a noop run. > > If there was a clear word that described this functionality, we > probably wouldn't be having this discussion. > > > > > > > On Sun, Jan 23, 2011 at 6:50 PM, Patrick wrote: > >> > >> On Jan 23, 2011, at 4:47 PM, James Louis wrote: > >> > >> > that tells what options are applied when --test is used but doesn't > >> > explain the functionality of --test (i.e. --test is an option to > enable the > >> > puppet agent to test it's connection to the puppet master by turning > on the > >> > following options... blah blah blah) > >> > >> Ah. Basically, test doesn't do anything except turn on all those > options. > >> > >> -- > >> You received this message because you are subscribed to the Google > Groups > >> "Puppet Users" group. > >> To post to this group, send email to puppet-users@googlegroups.com. > >> To unsubscribe from this group, send email to > >> puppet-users+unsubscr...@googlegroups.com > . > >> For more options, visit this group at > >> http://groups.google.com/group/puppet-users?hl=en. > >> > > > > > > > > -- > > “Twenty years from now you will be more disappointed by the things that > you > > didn’t do than by the ones you did do. So throw off the bowlines. Sail > away > > from the safe harbor. Catch the trade winds in your sails. Explore. > Dream. > > Discover.” > > – Mark Twain > > > > -- > > You received this message because you are subscribed to the Google Groups > > "Puppet Users" group. > > To post to this group, send email to puppet-users@googlegroups.com. > > To unsubscribe from this group, send email to > > puppet-users+unsubscr...@googlegroups.com > . > > For more options, visit this group at > > http://groups.google.com/group/puppet-users?hl=en. > > > > -- > You received this message because you are subscribed to the Google Groups > "Puppet Users" group. > To post to this group, send email to puppet-users@googlegroups.com. > To unsubscribe from this group, send email to > puppet-users+unsubscr...@googlegroups.com > . > For more options, visit this group at > http://groups.google.com/group/puppet-users?hl=en. > > -- “Twenty years from now you will be more disappointed by the things that you didn’t do than by the ones you did do. So throw off the bowlines. Sail away from the safe harbor. Catch the trade winds in your sails. Explore. Dream. Discover.” – Mark Twain -- You received this message because you are subscribed to the Google Groups "Puppet Users" group. To post to this group, send email to puppet-users@googlegroups.com. To unsubscribe from this group, send email to puppet-users+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en.
Re: [Puppet Users] Re: Do we need a new name for "--test"?
so the purpose of having a noop is to run the same test but to not actually make any changes. do we get the same debug messages, etc? On Sun, Jan 23, 2011 at 7:58 PM, eshamow wrote: > I can tell you that for me, and for my group, it's a halfway step > between reloading Puppet and watching the logs, and a full --debug -- > no-daemonize run. > > So for instance, when they're troubleshooting a bug in a newly-written > or modified class, I suggest a puppetd -tv run to just output the > errors and successes...and if you see an error, you could then follow > up with the more verbose --debug to get at what Puppet was trying to > do that generated it, provided that you didn't get enough from the > former. > > It might be wise to consider combining a bunch of similar options > (verbose, test, debug, etc) into a "verbose" with levels of output -- > either v1, v2, v3 or vv, vvv, , etc. > > -Eric > > > On Jan 23, 8:51 pm, Nigel Kersten wrote: > > On Sun, Jan 23, 2011 at 5:34 PM, James Louis > wrote: > > > so the actual changes take place, if any, during a test vs a noop which > does > > > not let the actual changes take place. So this would be used primarily > for > > > configuration testing? Or perhaps for troubleshooting? Or both? > > > > Yes, both. > > > > Due to it being quick to type, it's become the defacto method for > > interactively triggering puppet agent runs. > > > > puppet agent -t > > > > Maybe the right answer is to identify the chunks of functionality > > people use it for, and add those as new options, deprecating --test > > itself. > > > > > > > > > > > > > > > > > > > > > On Sun, Jan 23, 2011 at 7:22 PM, Nigel Kersten > wrote: > > > > >> On Sun, Jan 23, 2011 at 4:53 PM, James Louis > wrote: > > >> > exactly. to what purpose? > > > > >> To trigger an immediate run on a client with the common options used > > >> when testing a real run, not a noop run. > > > > >> If there was a clear word that described this functionality, we > > >> probably wouldn't be having this discussion. > > > > >> > On Sun, Jan 23, 2011 at 6:50 PM, Patrick wrote: > > > > >> >> On Jan 23, 2011, at 4:47 PM, James Louis wrote: > > > > >> >> > that tells what options are applied when --test is used but > doesn't > > >> >> > explain the functionality of --test (i.e. --test is an option to > > >> >> > enable the > > >> >> > puppet agent to test it's connection to the puppet master by > turning > > >> >> > on the > > >> >> > following options... blah blah blah) > > > > >> >> Ah. Basically, test doesn't do anything except turn on all those > > >> >> options. > > > > >> >> -- > > >> >> You received this message because you are subscribed to the Google > > >> >> Groups > > >> >> "Puppet Users" group. > > >> >> To post to this group, send email to puppet-users@googlegroups.com > . > > >> >> To unsubscribe from this group, send email to > > >> >> puppet-users+unsubscr...@googlegroups.com > . > > >> >> For more options, visit this group at > > >> >>http://groups.google.com/group/puppet-users?hl=en. > > > > >> > -- > > >> > “Twenty years from now you will be more disappointed by the things > that > > >> > you > > >> > didn’t do than by the ones you did do. So throw off the bowlines. > Sail > > >> > away > > >> > from the safe harbor. Catch the trade winds in your sails. Explore. > > >> > Dream. > > >> > Discover.” > > >> > – Mark Twain > > > > >> > -- > > >> > You received this message because you are subscribed to the Google > > >> > Groups > > >> > "Puppet Users" group. > > >> > To post to this group, send email to puppet-users@googlegroups.com. > > >> > To unsubscribe from this group, send email to > > >> > puppet-users+unsubscr...@googlegroups.com > . > > >> > For more options, visit this group at > > >> >http://groups.google.com/group/puppet-users?hl=en. > > > > >> -- > > >> You received this message because you are subsc
Re: [Puppet Users] Puppet on a purely push basis no possible?
My experience is having "listen = true" in the puppet conf and starting the client with --no-client does prevent the puppet pull. This works for me so that I can issue a puppet kick on the server to only serve changes when I want to. On Tue, Feb 15, 2011 at 2:54 PM, Nan Liu wrote: > On Tue, Feb 15, 2011 at 11:21 AM, Kristopher wrote: > > I would like to confirm that the following is not possible: > > I have servers I would like to manage via puppet in my DMZ, I have my > > puppet server in the trusted zone of my network. Due to this > > arrangement (which cannot be changed due to other services running on > > the puppet master) puppet clients cannot initiate a connection with > > the puppet master. So I would like to use puppet on a purely push > > basis using puppet kick. > > > > So I handled the cert signing out of band for a client and set up the > > namespaceauth.conf. The problem is that when I start the client with -- > > no-client and --listen it still tries to connect to the puppet server, > > which fails because of the firewall rules. In addition when I asked on > > #puppet I was informed that puppet kick just tells the client to phone > > home by creating a new connection to request its configs. > > > > From all this I came to conclusion that puppet cannot be used on a > > purely push basis, is this true? If it is true is it likely to change > > at any point? > > If you do not want the puppet agent to initiate any network connection > to the puppet master, compile the catalog on the master, ship the > catalog and dependent files to the agent, then apply the catalog on > the agent. > > Thanks, > > Nan > > -- > You received this message because you are subscribed to the Google Groups > "Puppet Users" group. > To post to this group, send email to puppet-users@googlegroups.com. > To unsubscribe from this group, send email to > puppet-users+unsubscr...@googlegroups.com. > For more options, visit this group at > http://groups.google.com/group/puppet-users?hl=en. > > -- To be is to do = Immanuel Kant To do is to be = Descartes. Do be do be do = Frank Sinatra -- You received this message because you are subscribed to the Google Groups "Puppet Users" group. To post to this group, send email to puppet-users@googlegroups.com. To unsubscribe from this group, send email to puppet-users+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en.
Re: [Puppet Users] Puppet on a purely push basis no possible?
in spite of this not actually being a "push" mechanism if it walks like a duck. it would be nice if the documentation and previous discussions on this were more clear or even better if it's not a "push" then the it should be "redefined" within puppet world. IMHO On Tue, Feb 15, 2011 at 4:07 PM, Daniel Pittman wrote: > Other people answered other parts of this, but to be totally clear: > > 'puppet kick' is *NOT* a push mechanism for puppet. It is a mechanism > to trigger the regular, pull-based, puppet run on a specific machine. > > In the bigger picture I would strongly suggest you just open the > single port used for puppet management from the DMZ to the secure > network, and allow that (and only that) exception. Alternately, > establish a second puppet master in the DMZ for use there, and feed it > catalogs from the same VCS that the internal one uses. > > (Personally, I would suggest that opening the port is less security > auditing overhead than an entire puppet master out in the DMZ, but > YM(and auditors)MV.) > > Daniel > > On Tue, Feb 15, 2011 at 13:04, James Louis wrote: > > My experience is having "listen = true" in the puppet conf and starting > the > > client with --no-client does prevent the puppet pull. This works for me > so > > that I can issue a puppet kick on the server to only serve changes when I > > want to. > > > > On Tue, Feb 15, 2011 at 2:54 PM, Nan Liu wrote: > >> > >> On Tue, Feb 15, 2011 at 11:21 AM, Kristopher > wrote: > >> > I would like to confirm that the following is not possible: > >> > I have servers I would like to manage via puppet in my DMZ, I have my > >> > puppet server in the trusted zone of my network. Due to this > >> > arrangement (which cannot be changed due to other services running on > >> > the puppet master) puppet clients cannot initiate a connection with > >> > the puppet master. So I would like to use puppet on a purely push > >> > basis using puppet kick. > >> > > >> > So I handled the cert signing out of band for a client and set up the > >> > namespaceauth.conf. The problem is that when I start the client with > -- > >> > no-client and --listen it still tries to connect to the puppet server, > >> > which fails because of the firewall rules. In addition when I asked on > >> > #puppet I was informed that puppet kick just tells the client to phone > >> > home by creating a new connection to request its configs. > >> > > >> > From all this I came to conclusion that puppet cannot be used on a > >> > purely push basis, is this true? If it is true is it likely to change > >> > at any point? > >> > >> If you do not want the puppet agent to initiate any network connection > >> to the puppet master, compile the catalog on the master, ship the > >> catalog and dependent files to the agent, then apply the catalog on > >> the agent. > >> > >> Thanks, > >> > >> Nan > >> > >> -- > >> You received this message because you are subscribed to the Google > Groups > >> "Puppet Users" group. > >> To post to this group, send email to puppet-users@googlegroups.com. > >> To unsubscribe from this group, send email to > >> puppet-users+unsubscr...@googlegroups.com. > >> For more options, visit this group at > >> http://groups.google.com/group/puppet-users?hl=en. > >> > > > > > > > > -- > > To be is to do = Immanuel Kant > > To do is to be = Descartes. > > Do be do be do = Frank Sinatra > > > > -- > > You received this message because you are subscribed to the Google Groups > > "Puppet Users" group. > > To post to this group, send email to puppet-users@googlegroups.com. > > To unsubscribe from this group, send email to > > puppet-users+unsubscr...@googlegroups.com. > > For more options, visit this group at > > http://groups.google.com/group/puppet-users?hl=en. > > > > > > -- > ⎋ Puppet Labs Developer – http://puppetlabs.com > ✉ Daniel Pittman > ✆ Contact me via gtalk, email, or phone: +1 (877) 575-9775 > ♲ Made with 100 percent post-consumer electrons > > -- > You received this message because you are subscribed to the Google Groups > "Puppet Users" group. > To post to this group, send email to puppet-users@googlegroups.com. > To unsubscribe from this group, send email to > puppet-users+unsubscr...@googlegroups.com. > For more options, visit this group at > http://groups.google.com/group/puppet-users?hl=en. > > -- To be is to do = Immanuel Kant To do is to be = Descartes. Do be do be do = Frank Sinatra -- You received this message because you are subscribed to the Google Groups "Puppet Users" group. To post to this group, send email to puppet-users@googlegroups.com. To unsubscribe from this group, send email to puppet-users+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en.
Re: [Puppet Users] Sensible, Manageable, CentOS puppetmaster?
set enabled=0 in /etc/yum.repos.d/epel.repo and use --enablerepo=epel when using yum to install puppet On Wed, Feb 16, 2011 at 7:27 AM, Romain Pelisse wrote: > Personnally, I just used the EPEL repository to install both puppet and > puppetmaster. I still need to figure out a way to tell to yum "hey use EPEL > only for puppet" but except for that it works fine... > > > On 16 February 2011 12:16, Howard Jones wrote: > >> I've been going round in circles a little bit in the last few days >> trying to figure out how to get a 64-bit CentOS-based puppetmaster >> that can be managed/provisioned via puppet also - so I'd like ruby, >> passenger, rails etc coming from RPMs and yum. As far as I can see, >> the three choices are: >> 1) Puppetlabs prosvc repo, which specifically says it can go away at any >> time >> 2) Premiumhelp repo - 32-bit only >> 3) My own local repo (although I couldn't find working src.rpm/spec >> files for ruby, and I'm by no means a ruby expert) >> >> What does everyone else do? It seems weird that the tool intended to >> manage everything else is so hard to manage itself (package-wise), so >> I'm assuming I've missed something obvious... obviously there is a >> choice 4 - just build it all from source - but that feels dirty, >> especially on the puppet server! >> >> Thanks in advance for any illumination, >> >> Howie >> >> -- >> You received this message because you are subscribed to the Google Groups >> "Puppet Users" group. >> To post to this group, send email to puppet-users@googlegroups.com. >> To unsubscribe from this group, send email to >> puppet-users+unsubscr...@googlegroups.com. >> For more options, visit this group at >> http://groups.google.com/group/puppet-users?hl=en. >> >> > > > -- > Romain PELISSE, > *"The trouble with having an open mind, of course, is that people will > insist on coming along and trying to put things in it" -- Terry Pratchett* > http://belaran.eu/wordpress/belaran > > -- > You received this message because you are subscribed to the Google Groups > "Puppet Users" group. > To post to this group, send email to puppet-users@googlegroups.com. > To unsubscribe from this group, send email to > puppet-users+unsubscr...@googlegroups.com. > For more options, visit this group at > http://groups.google.com/group/puppet-users?hl=en. > -- To be is to do = Immanuel Kant To do is to be = Descartes. Do be do be do = Frank Sinatra -- You received this message because you are subscribed to the Google Groups "Puppet Users" group. To post to this group, send email to puppet-users@googlegroups.com. To unsubscribe from this group, send email to puppet-users+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en.
Re: [Puppet Users] Puppet on a purely push basis no possible?
I see what you are saying. We are going with a plan to authorize an opening in the firewall for just the instance of the kick. As any changes to our production environment require a change request one would have to be created to allow the ports to be opened just for the kick. On Tue, Feb 15, 2011 at 9:22 PM, Patrick wrote: > I think you're saying that it's close enough that it shouldn't matter. In > the context of this thread, there's a huge difference though. If the puppet > client is in a DMZ, (and can't connect to the puppetmaster) it needs the > catalog to be pushed to the client. Not just the server telling the client > to pull the config, because the client can't connect to the server since the > client is locked in the DMZ. > > On Feb 15, 2011, at 5:37 PM, James Louis wrote: > > in spite of this not actually being a "push" mechanism if it walks like a > duck. it would be nice if the documentation and previous discussions on this > were more clear or even better if it's not a "push" then the it should be > "redefined" within puppet world. IMHO > > On Tue, Feb 15, 2011 at 4:07 PM, Daniel Pittman wrote: > >> Other people answered other parts of this, but to be totally clear: >> >> 'puppet kick' is *NOT* a push mechanism for puppet. It is a mechanism >> to trigger the regular, pull-based, puppet run on a specific machine. >> >> In the bigger picture I would strongly suggest you just open the >> single port used for puppet management from the DMZ to the secure >> network, and allow that (and only that) exception. Alternately, >> establish a second puppet master in the DMZ for use there, and feed it >> catalogs from the same VCS that the internal one uses. >> >> (Personally, I would suggest that opening the port is less security >> auditing overhead than an entire puppet master out in the DMZ, but >> YM(and auditors)MV.) >> >> Daniel >> >> On Tue, Feb 15, 2011 at 13:04, James Louis wrote: >> > My experience is having "listen = true" in the puppet conf and starting >> the >> > client with --no-client does prevent the puppet pull. This works for me >> so >> > that I can issue a puppet kick on the server to only serve changes when >> I >> > want to. >> > >> > On Tue, Feb 15, 2011 at 2:54 PM, Nan Liu wrote: >> >> >> >> On Tue, Feb 15, 2011 at 11:21 AM, Kristopher >> wrote: >> >> > I would like to confirm that the following is not possible: >> >> > I have servers I would like to manage via puppet in my DMZ, I have my >> >> > puppet server in the trusted zone of my network. Due to this >> >> > arrangement (which cannot be changed due to other services running on >> >> > the puppet master) puppet clients cannot initiate a connection with >> >> > the puppet master. So I would like to use puppet on a purely push >> >> > basis using puppet kick. >> >> > >> >> > So I handled the cert signing out of band for a client and set up the >> >> > namespaceauth.conf. The problem is that when I start the client with >> -- >> >> > no-client and --listen it still tries to connect to the puppet >> server, >> >> > which fails because of the firewall rules. In addition when I asked >> on >> >> > #puppet I was informed that puppet kick just tells the client to >> phone >> >> > home by creating a new connection to request its configs. >> >> > >> >> > From all this I came to conclusion that puppet cannot be used on a >> >> > purely push basis, is this true? If it is true is it likely to >> change >> >> > at any point? >> >> >> >> If you do not want the puppet agent to initiate any network connection >> >> to the puppet master, compile the catalog on the master, ship the >> >> catalog and dependent files to the agent, then apply the catalog on >> >> the agent. >> >> >> >> Thanks, >> >> >> >> Nan >> >> >> >> -- >> >> You received this message because you are subscribed to the Google >> Groups >> >> "Puppet Users" group. >> >> To post to this group, send email to puppet-users@googlegroups.com. >> >> To unsubscribe from this group, send email to >> >> puppet-users+unsubscr...@googlegroups.com. >> >> For more options, visit this group at >> >> http://groups.google.com
